>From 92c874e6dd22f679db58c0850dabc955ef817e47 Mon Sep 17 00:00:00 2001
From: Lukas Slebodnik <lslebodn@redhat.com>
Date: Thu, 17 Jul 2014 13:46:14 +0200
Subject: [PATCH] ldap_opts: Get rid on 389ds specific values in rfc2307bis
 schema

There is problem with OpenLDAP server and dereferencing of attributes
that is not in the schema  of the server?

sh-4.2$ ldapsearch -x -LLL -h openldap.server.test -b 'dc=example,dc=com' \
                   -E 'deref=member:uid,dummy_attr' cn=ref_grp
Protocol error (2)
Additional information: Dereference control: attribute decoding error
sh-4.2$ echo $?
2

The attribute nsUniqueID is a 389-only, non-standard attribute.
It is an operational attribute that is not in the rfc2307bis nor inetOrgPerson
nor posixAccount schema.  OpenLDAP supports the standard entryUUID attribute,
which is basically the same (uniquely identifies an entry throughout
a replication topology), but uses the standard UUID format rather than
the non-standard format used by 389.

Resolves:
https://fedorahosted.org/sssd/ticket/2383
---
 src/man/sssd-ldap.5.xml        | 6 +++---
 src/providers/ad/ad_opts.h     | 3 +--
 src/providers/ldap/ldap_opts.h | 9 +++------
 3 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/src/man/sssd-ldap.5.xml b/src/man/sssd-ldap.5.xml
index 7b5ee34705c180075e573c11de4553cb2658cd28..3448389fb1da15565736b46286a52e8b4225f999 100644
--- a/src/man/sssd-ldap.5.xml
+++ b/src/man/sssd-ldap.5.xml
@@ -345,7 +345,7 @@
                             an LDAP user object.
                         </para>
                         <para>
-                            Default: nsUniqueId
+                            Default: entryUUID
                         </para>
                     </listitem>
                 </varlistentry>
@@ -863,7 +863,7 @@
                             an LDAP group object.
                         </para>
                         <para>
-                            Default: nsUniqueId
+                            Default: entryUUID
                         </para>
                     </listitem>
                 </varlistentry>
@@ -1100,7 +1100,7 @@
                             be used instead.
                         </para>
                         <para>
-                            Default: nsUniqueId
+                            Default: entryUUID
                         </para>
                     </listitem>
                 </varlistentry>
diff --git a/src/providers/ad/ad_opts.h b/src/providers/ad/ad_opts.h
index b80aaddf29b7fb236d89bfb4e148bba7aeeecd14..5251ebbcd49573121051c8810d2683fc779edb1e 100644
--- a/src/providers/ad/ad_opts.h
+++ b/src/providers/ad/ad_opts.h
@@ -223,8 +223,7 @@ struct sdap_attr_map ad_netgroup_map[] = {
     { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL },
     { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL },
     { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL },
+    { "ldap_netgroup_uuid", "entryUUID", SYSDB_UUID, NULL },
     { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     SDAP_ATTR_MAP_TERMINATOR
 };
diff --git a/src/providers/ldap/ldap_opts.h b/src/providers/ldap/ldap_opts.h
index 39c24733261e744aaff2954dad56c2609122bf49..8d072db499d24ebd2b7320e5b7734f4817aee54f 100644
--- a/src/providers/ldap/ldap_opts.h
+++ b/src/providers/ldap/ldap_opts.h
@@ -207,8 +207,7 @@ struct sdap_attr_map rfc2307bis_user_map[] = {
     { "ldap_user_principal", "krbPrincipalName", SYSDB_UPN, NULL },
     { "ldap_user_fullname", "cn", SYSDB_FULLNAME, NULL },
     { "ldap_user_member_of", "memberOf", SYSDB_MEMBEROF, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_user_uuid", "nsUniqueId", SYSDB_UUID, NULL },
+    { "ldap_user_uuid", "entryUUID", SYSDB_UUID, NULL },
     { "ldap_user_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_user_primary_group", NULL, SYSDB_PRIMARY_GROUP, NULL },
     { "ldap_user_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
@@ -241,8 +240,7 @@ struct sdap_attr_map rfc2307bis_group_map[] = {
     { "ldap_group_pwd", "userPassword", SYSDB_PWD, NULL },
     { "ldap_group_gid_number", "gidNumber", SYSDB_GIDNUM, NULL },
     { "ldap_group_member", "member", SYSDB_MEMBER, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_group_uuid", "nsUniqueId", SYSDB_UUID, NULL },
+    { "ldap_group_uuid", "entryUUID", SYSDB_UUID, NULL },
     { "ldap_group_objectsid", NULL, SYSDB_SID, NULL },
     { "ldap_group_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     { "ldap_group_entry_usn", NULL, SYSDB_USN, NULL },
@@ -308,8 +306,7 @@ struct sdap_attr_map netgroup_map[] = {
     { "ldap_netgroup_name", "cn", SYSDB_NAME, NULL },
     { "ldap_netgroup_member", "memberNisNetgroup", SYSDB_ORIG_NETGROUP_MEMBER, NULL },
     { "ldap_netgroup_triple", "nisNetgroupTriple", SYSDB_NETGROUP_TRIPLE, NULL },
-    /* FIXME: this is 389ds specific */
-    { "ldap_netgroup_uuid", "nsUniqueId", SYSDB_UUID, NULL },
+    { "ldap_netgroup_uuid", "entryUUID", SYSDB_UUID, NULL },
     { "ldap_netgroup_modify_timestamp", "modifyTimestamp", SYSDB_ORIG_MODSTAMP, NULL },
     SDAP_ATTR_MAP_TERMINATOR
 };
-- 
1.9.3